中
5.4
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting...
CVE-2026-119054
SecPulse初出
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Themeisle | Multiple Pages Generator by Themeisle |
4.2.5 未満 |
4.2.5 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory